Skip to content
Fencer Vulns
critical 9.4

CVE-2023-45133 json

Babel vulnerable to arbitrary code execution when compiling specifically crafted malicious code

published 2023-10-12 3 y ago modified 2026-09-10 1 mo ago also GHSA-67hx-6x53-jw92 , EUVD-2023-2669

cvss
9.4
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.5%
EPSS 0.5% chance of exploitation in 30 days, percentile 44%
public exploits
0
none known

Summary

Babel is a compiler for writingJavaScript. In `@babel/traverse` prior to versions 7.23.2 and 8.0.0-alpha.4 and all versions of `babel-traverse`, using Babel to compile code that was specifically crafted by an attacker can lead to arbitrary code execution during compilation, when using plugins that rely on the `path.evaluate()`or `path.evaluateTruthy()` internal Babel methods. Known affected plugins are `@babel/plugin-transform-runtime`; `@babel/preset-env` when using its `useBuiltIns` option; and any "polyfill provider" plugin that depends on `@babel/helper-define-polyfill-provider`, such as `babel-plugin-polyfill-corejs3`, `babel-plugin-polyfill-corejs2`, `babel-plugin-polyfill-es-shims`, `babel-plugin-polyfill-regenerator`. No other plugins under the `@babel/` namespace are impacted, but third-party plugins might be. Users that only compile trusted code are not impacted. The vulnerability has been fixed in `@babel/traverse@7.23.2` and `@babel/traverse@8.0.0-alpha.4`. Those who cannot upgrade `@babel/traverse` and are using one of the affected packages mentioned above should upgrade them to their latest version to avoid triggering the vulnerable code path in affected `@babel/traverse` versions: `@babel/plugin-transform-runtime` v7.23.2, `@babel/preset-env` v7.23.2, `@babel/helper-define-polyfill-provider` v0.4.3, `babel-plugin-polyfill-corejs2` v0.4.6, `babel-plugin-polyfill-corejs3` v0.8.5, `babel-plugin-polyfill-es-shims` v0.10.0, `babel-plugin-polyfill-regenerator` v0.5.3.

Patch / fix

  • npm @babel/traverse 7.23.2, 8.0.0-alpha.4
  • babeljs babel 7.23.2
  • babeljs babel-helper-define-polyfill-provider 0.4.3
  • babeljs babel-plugin-polyfill-corejs2 0.4.6
  • babeljs babel-plugin-polyfill-corejs3 0.8.5
  • babeljs babel-plugin-polyfill-es-shims 0.10.0
  • babeljs babel-plugin-polyfill-regenerator 0.5.3
  • babeljs babel-plugin-transform-runtime 7.23.2
  • babeljs babel-preset-env 7.23.2
  • node-babel7 Debian 12 7.20.15+ds1+~cs214.269.168-3+deb12u1
  • node-babel7 Debian 14, Debian 13 7.20.15+ds1+~cs214.269.168-5

debian advisories DEBIAN-CVE-2023-45133

  • velociraptor openSUSE Tumbleweed 0.7.0.4.git142.862ef23-1.1
  • teleport openSUSE Tumbleweed 14.1.1-1.1

opensuse advisories openSUSE-SU-2025:14663-1openSUSE-SU-2024:13360-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2023-45133 updated cvss 8.8

babel: arbitrary code execution

  • Red Hat Storage 3 babel, python-babel
    affected: workaround, no fix planned “Will not fix”
  • Red Hat Logging Subsystem for Red Hat OpenShift openshift-logging/kibana6-rhel8 Red Hat Enterprise Linux 8 babel, python3-babel Red Hat Enterprise Linux 9 babel, python3-babel Red Hat Single Sign-On 7 babel
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
2 y ago

Exploit prediction

0.53% chance of exploitation in the next 30 days, higher than 44% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 9.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
NVD 3.1 8.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
GitHub 3.1 9.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Affected packages

ecosystem package affected fixed in
npm @babel/traverse
<7.23.2
>=8.0.0-alpha.0, <8.0.0-alpha.4
7.23.2
8.0.0-alpha.4
npm babel-traverse
all versions
 no fix listed

Affected products

  • babel babel

Classification

Weakness
  • CWE-184 Incomplete List of Disallowed Inputs
  • CWE-697 Incorrect Comparison

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.